Creating a Cybersecurity Strategy

The digital era we live in has allowed for immeasurable innovations and has exposed our data and private information to countless threats. As enterprises support innovation and growth, cybersecurity needs to be a central part of business. Enterprises need to think security-first—whether that’s in regard to designing new products and services, signing partnership agreements, or hiring employees. There are several measures businesses can employ to create a strong cybersecurity strategy that implements effective security policies and solutions.

Cybersecurity begins with awareness

Humans have the opportunity to be the greatest defense against cyberattacks, but most are often found to be the weakest link in the chain. Lack of proper training and prioritization of a strong security posture leave employees vulnerable to accidentally releasing attacks into the business. The first step in developing a strong cybersecurity framework is to ensure security is built into the fabric of the business. To effectively craft and deploy this strategy, top-level management should consider resources, business drivers, data, controls, and threats as well as human and organizational dynamics.

Employees must understand that every enterprise will experience a cyberattack, whether they realize it or not. Even with resilient controls in place, attackers can still find ways to exploit the weakest link. In many cases, these attacks are easily preventable with fundamental security measures in place. Cybersecurity basics like maintaining strong authentication practices and keeping sensitive data in protected locations will help mitigate most rudimentary threats. Creating awareness on the importance of cybersecurity and training employees on how to be proactive in safeguarding private information is just as important as building a strong security operations center. Establishing a culture of risk management and accountability ensures that security becomes part of the business and not an afterthought.

Beyond the basics

A strong cybersecurity strategy must go beyond basic employee training and simple security hygiene practices. Attacks are becoming highly sophisticated and continue to increase in frequency and volume, enabling hackers to bypass most defenses. Companies are also managing multiple endpoints, with the number of end nodes ranging from a couple hundred to more than 50,000. This creates a larger attack surface for hackers to penetrate. Add in the rapid growth of digital innovation, and defending these systems has never been more important.

Protecting these systems requires cybersecurity solutions that address an array of tools and expertise. A good cybersecurity strategy considers the different types of cybersecurity and determines which tools and processes need to be employed. Several of the core areas of cybersecurity are:

Critical infrastructure — This includes cyber-physical systems such as electricity grids and traffic lights. Organizations responsible for critical infrastructures should perform due diligence to understand the potential vulnerabilities and employ the proper measures to defend against them.

Network security — Guards against unauthorized invasion and malevolent insiders. While monitoring network security tends to generate incredible amounts of data, many security professionals are adopting machine learning to assist in sorting through data and alerting teams of threats in real time.

Application security — Helps identify, fix, and prevent security risk in any kind of software application, whether it’s built internally, bought, or downloaded. Incorporating secure coding practices as well as fuzzing and penetration testing will augment application security and help mitigate major threats.

Cloud security — Includes protecting critical information from theft, deletion, and data exposure. New security tools are being created to help enterprises understand and better secure their data in the cloud.

Internet of things (IoT) security — Refers to an array of critical and non-critical cyber-physical systems, including printers and security cameras. These devices frequently offer limited security patching, which renders users and other internet users vulnerable to threats. IoT security creates a unique challenge for both the user and the enterprise.

Cybersecurity policy — Businesses need to develop a strong set of security policies and practices that are practiced at the top-level of management, and all the way down. These policies are critical to maintaining a well-rounded, proactive security strategy.

No one size fits all

Just like there is no one security product or vendor who can completely eradicate all threats, there is also not a single cybersecurity strategy that properly addresses the needs of every business. Each enterprise is unique and requires a customized approach. However, it’s key that all the pieces of the strategy are cohesive and work together. Deploying fragmented tools can result in an inability to gain comprehensive visibility to monitor and understand changing events and risk across an organization’s security landscape. Plus, a non-integrated system creates high risk for human error and checking data across multiple consoles is incredibly time consuming.

At McAfee, we believe that solving the cybersecurity challenge takes all of us working together, building an adaptive environment that is open, proactive, platform-based, and partner-powered. With the safety of our customers’ environments at the forefront, we work every day with cybersecurity solutions from both complementary and competing third-party vendors to build integrations that are useful and just as feature rich as the integrations between our own solutions. This gives our customers the best of both worlds: vendor choice with simplified management. This allows for customization of security products without incurring additional costs or compromise of vendor selection. We’ve expanded on this open ecosystem approach by building the Open Data Exchange Layer (Open DXL), which further removes political or industry-competitive barriers to the integration and collaboration of security solutions to drive outcomes for our customers.